5.3 Given a scenario, use the appropriate network software tools and commands

Question 1

Which command-line command in MS Windows is used to display the contents of a routing table?

ipconfig /all

netstat -a

route print

print route

Answer 1

To display the local routing table in MS Windows, one would open a command prompt, type route print, then press Enter. The admin can then observe the active routes by destination, network mask, gateway, interface, and metric.

Ipconfig /all displays all configuration information for each adapter bound to TCP/IP.

The netstat command generates displays that show network status and protocol statistics. One can display the status of TCP and UDP endpoints in a table format, routing table information, and interface information.

The print route is an invalid command and will not display any results.

Question 2

IT security specialists respond to a security breach. An investigation determines that open service ports on an old server was the entry point for malicious activity. Which of the following utilities should the specialists use to determine the cause of the breach?

arp

netstat

dig

pathping

Answer 2

The netstat command allows for checking the state of ports on a local host. Service misconfigurations can be found by using this command.

The Address Resolution Protocol (ARP) arp command is used to perform the task of resolving a logical Internet Protocol (IP) address to a physical hardware address.

The pathping utility performs a trace route, then pings each hop router a given number of times for a given period to determine the Round Trip Time (RTT) for the path.

The domain information groper (dig) utility is used to query a Domain Name System (DNS) server and return information about a particular domain name.